On May 6, 2011, the Californian PUC (CPUC) issued a proposed decision [[link]]] by CPUC President Peevey addressing smart grid privacy and security. The proposed decision is part of a longstanding proceeding we first discussed [here]. The proposed decision represents a significant step towards the first set of specific smart grid privacy rules in the United States during a time that smart grid privacy is attracting increasing global attention. For example, as discussed in the Chronicle of Data Protection post on April 18, 2011, the European Union’s Article 29 Working Party issued smart meter guidelines last month.
Europe’s group of data protection authorities, the Article 29 Working Party, issued an opinion on smart meters, which goes into surprising detail on points such as the size of the display for the user interface, the need for a ‘push button’ consent module for consumers, the need to keep load graph data stored locally whenever possible. The Art 29 WP stresses the need for energy suppliers and third party energy service companies to develop detailed data retention policies to ensure smart meter data are deleted as soon as no longer needed.
A presentation by Hogan Lovells privacy partners compares European Commission “EG2” privacy recommendations for smart grids with the comparable recommendations of the NIST. We explain the concept of “privacy by design” in the smart grid environment and the use of detailed privacy use cases to mitigate system risks. The presentation compares the U.S. concept of “PII” with the European concept of “personal data” and discusses the risks associated with transferring household electricity data to third parties, as is mandated by California and Italian law.